I think the Attachment Download Limit should be set as part of a user's
individual preferences, but the default should probably be set to a pretty
small size. More savvy users can increse it if they wish.

I see this as a size setting rather than an on/off switch. Default might be
anything with a total of attachments over 100Kb would get a link. (I'm not
sure where attachments would go??) Options would increase the limit to a
total of 1Mb or an unlimited size.

This brings to mind a concern I have. Some of our older and less tech-savvy members have a lot of trouble with individual settings related to their accounts. Could there be a switch at the top of the Subscriptions page that a member could set to allow an owner or highest privelege moderator to change the members settings? Perhaps this could go so far as to allow the owner to change message delivery settings and add alternate email addresses. I'll explain.

We have a group member over on Y that has his system so messed up that the only way he can communicate with the group is by sending an email to someone else and getting them to forward it on. On a couple occasions someone was able to visit this person and straighten things out, but they didn't stay. This person is hours away from anyone who could assist him. I and the top moderator have tried to talk him through changing his settings to be able to reconnect, but he's just lost with any of it. Direct add of members would allow us some way to reconnect him and delete his old account, but we still need to be able to change things to help him out.

I recognize this pushes some security concerns and I hope others will add their own thoughts to this. These valuable but limited members have a lot to offer, but sometimes need a little more help than we can offer.

Dano

I have encountered members like that, and would welcome some way to help them. Trying to explain how to do something as simple as changing your email address on yahoo's convoluted system is hard enough, but those people can't understand and execute the explanation anyway, so they just give up.
Cacky

On 2/10/2015 12:47 PM, D R Stinson wrote:

I think the Attachment Download Limit should be set as part of a user's
individual preferences, but the default should probably be set to a pretty
small size. More savvy users can increse it if they wish.

I see this as a size setting rather than an on/off switch. Default might be
anything with a total of attachments over 100Kb would get a link. (I'm not
sure where attachments would go??) Options would increase the limit to a
total of 1Mb or an unlimited size.

This brings to mind a concern I have. Some of our older and less tech-savvy members have a lot of trouble with individual settings related to their accounts. Could there be a switch at the top of the Subscriptions page that a member could set to allow an owner or highest privelege moderator to change the members settings? Perhaps this could go so far as to allow the owner to change message delivery settings and add alternate email addresses. I'll explain.

We have a group member over on Y that has his system so messed up that the only way he can communicate with the group is by sending an email to someone else and getting them to forward it on. On a couple occasions someone was able to visit this person and straighten things out, but they didn't stay. This person is hours away from anyone who could assist him. I and the top moderator have tried to talk him through changing his settings to be able to reconnect, but he's just lost with any of it. Direct add of members would allow us some way to reconnect him and delete his old account, but we still need to be able to change things to help him out.

I recognize this pushes some security concerns and I hope others will add their own thoughts to this. These valuable but limited members have a lot to offer, but sometimes need a little more help than we can offer.

Dano

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com

I like the idea also and it does push the security concerns. We have some problems similar to what you mentioned and it is very frustrating when you provide step by step instructions on how to do things, sometime even with pictures and they still can't do it.

If something is set up like this, there definitely needs to be something put in place so the owner/moderators aren't liable for making changes. I say this, because I have had members that forgot that they told me to do something and then get upset. So I now have them send me an email and I keep them.

Great idea!
Judy F.
SW Florida - USA

One way to deal with it is to have the user set a temporary password and email that password to the moderator who is going to set up his account. After the account is setup to the member's satisfaction, the moderator can 'lock' the account settings, and then the member can change the password for his account to something the moderator doesn't know. That way, the account gets set up properly and the user is secure AND the settings don't get all bolloxed up again.

Terry S
--
"Women are Angels. And when someone breaks our wings.... We simply continue to fly ... on broomsticks... We are flexible..." - copied from a Facebook page because I love it!




On 2/10/2015 4:14 PM, J. Faulkner wrote:

I like the idea also and it does push the security concerns. We have some problems similar to what you mentioned and it is very frustrating when you provide step by step instructions on how to do things, sometime even with pictures and they still can't do it.

If something is set up like this, there definitely needs to be something put in place so the owner/moderators aren't liable for making changes. I say this, because I have had members that forgot that they told me to do something and then get upset. So I now have them send me an email and I keep them.

Great idea!
Judy F.
SW Florida - USA


-----Original Message-----
From: D R Stinson [mailto:dano@...]
Sent: Tuesday, February 10, 2015 1:48 PM
To: beta@groups.io
Subject: [beta] Allowing owner/moderator to assist member #member settings #security

This brings to mind a concern I have. Some of our older and less tech-savvy members have a lot of trouble with individual settings related to their accounts. Could there be a switch at the top of the Subscriptions page that a member could set to allow an owner or highest privelege moderator to change the members settings? Perhaps this could go so far as to allow the owner to change message delivery settings and add alternate email addresses. I'll explain.

We have a group member over on Y that has his system so messed up that the only way he can communicate with the group is by sending an email to someone else and getting them to forward it on. On a couple occasions someone was able to visit this person and straighten things out, but they didn't stay. This person is hours away from anyone who could assist him. I and the top moderator have tried to talk him through changing his settings to be able to reconnect, but he's just lost with any of it. Direct add of members would allow us some way to reconnect him and delete his old account, but we still need to be able to change things to help him out.

I recognize this pushes some security concerns and I hope others will add their own thoughts to this. These valuable but limited members have a lot to offer, but sometimes need a little more help than we can offer.

Dano

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com

Terry, the reason this suggestion was made was to allow the owner/mod access to change some things because a lot of these members don't know how to do it and if they try they are making a mess out of it. I doubt if they would be able to set up a temporary password if they can't do the other stuff.

Judy F.
SW Florida - USA

Terry, the reason this suggestion was made was to allow the owner/mod access to change some things because a lot of these members don't know how to do it and if they try they are making a mess out of it. I doubt if they would be able to set up a temporary password if they can't do the other stuff.

Judy, you said it better than I can. But I understand Mark's concerns too. That's why it is imperative that the member make the first active move, although it needs to be something simple. And I really think this needs to be a separate permission explicitly given to only certain moderators. The default for the moderator would be off, and the Owner would have to turn it on specifically on only those moderators who were able and trusted.

Perhaps a member could only give such permission for a limited time and that permission would expire in five days, so the member would have to renew it each time it was needed.

Dano

I like the idea of permission only being given to an owner/moderator and not to all the moderators . I would still ask the member for an email stating it was OK and what changes would be made or something like that. Maybe I'm overly careful, but want all bases covered.

Judy F.
SW Florida - USA

I like the idea of permission only being given to an owner/moderator and

not to all the moderators . I would still ask the member for an email
stating it was OK and what changes would be made or something like that.
Maybe I'm overly careful, but want all bases covered.

I understand yuor concerns Judy, but most of the members we have trouble
with would have no idea what kind of "magic" they needed. They couldn't
really tell you what they needed much beyond "It's broke - fix it." That's
why something simple like the flip of a permission timer might be the
simplest thing to give them.

Dano

Hmm. You're probably right.

There has to be some way to secure the member's membership while still allowing the moderator to 'fix' the member's account settings when the member is not competent to do so. That's no reflection on the member's brilliance, but only on his computer literacy.

Terry S
--
"Women are Angels. And when someone breaks our wings.... We simply continue to fly ... on broomsticks... We are flexible..." - copied from a Facebook page because I love it!


On 2/10/2015 9:01 PM, J. Faulkner wrote:

Terry, the reason this suggestion was made was to allow the owner/mod access to change some things because a lot of these members don't know how to do it and if they try they are making a mess out of it. I doubt if they would be able to set up a temporary password if they can't do the other stuff.

Judy F.
SW Florida - USA

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com

Dano,

Perhaps this could go so far as to allow the owner to change message
delivery settings and add alternate email addresses.
...
I recognize this pushes some security concerns ...

Yeah, no kidding.

In Yahoo Groups the "Alternate Posting Address" was treated as an alias for the member's true address. In particular, without looking at the message header one couldn't tell that the alternate address had been used. I think under the hood it operated a lot like an email From address spoof. In the hands of an unscrupulous moderator that could be a nasty way to damage a member's reputation or convert the member into a sock-puppet.

If Groups.io were to implement something like this, or the ability to change a member's email address, I think it might be best thought of in the same ways as a Remote Assistance session: very useful, very dangerous.

I think member-initiated and time-limited are two good restrictions. My primary concern with that is the one expressed by Dano and Judy: how to make it simple enough for the member who needs it most to initiate it. Maybe there needs to be more than one way: an email way for members that can't find the group's pages and a web way for those who can't fathom an email command.

Direct add of members would allow us some way to reconnect him and
delete his old account, but we still need to be able to change things to
help him out.

That's the only way to change the address of an email-only member: Remove the old address and Add the new one. Which in Yahoo Groups ceased to be possible when they completely removed the Add Member feature. And isn't possible for free in Groups.io.

For members with web access that method is rude: it discards their subscription settings and destroys their identity as the owner of prior content (they would no longer be able to delete or edit the messages posted under the old address).

-- Shal

Shal -
I really appreciate your input on this. This isn't often needed, but when it is, it's the only way, short of going to where the member is, to help them. As you noted, it's the equivalent risk to remote access. And yet the industry still has a need for remote access, and for the same reason. Requiring that this be part of a paid subscription would also be one more protection. Otherwise, it's a similar situation to remote access, still requiring user permission first. And I am assuming there would be a separate trail of actions for access to user accounts. Just as with the IT industry, it appears to be a necessary evil in a few extreme situations.
Dano

As far as I know, in yahoogroups a moderator can change any setting from any member. I don't recall any story of that being a problem.

This doesn't include adding a new email-adress, but I think giving iogroups moderators that option wouldn't lead to problems either.

groetjes, Ronaldo

Ronaldo, I don't think this is true unless something has happened that I don't know about or there are other options that I did not know about.

I am an owner of a couple of groups and moderator of several with full access except deleting the group and the only thing I can do is change their mail delivery, i.e. Individual, Digest, etc. and unsubscribe. The other things I can do are owner/moderator type changes.

Judy F.
SW Florida - USA

On 2/11/2015 6:10 PM, J. Faulkner wrote:

I am an owner of a couple of groups and moderator of several with full access except deleting the group and the only thing I can do is change their mail delivery, i.e. Individual, Digest, etc. and unsubscribe.

Plus posting privs, moderate/not - that's about
all I know that I can do also.

dg

Mark,

I'm not sure how to handle changing someone's email address, as that's
much more invasive. Thoughts?

Although moderators of Yahoo Groups do get "this is my new address, please update my subscription" requests from members, I agree that giving this ability can lead to some thorny problems.

For one thing, in Groups.io the member's email address is not only the key to their subscription(s), but also to their profile. So a notification, as Linda suggested, to the old address would be a necessary step, at a minimum.

What happens if the old address has more than one subscription? In some sense it seems outrageous that a moderator of one group could affect the subscription list of another group. Yet that may be precisely what a naive group member needs and wants. So I'd say yes, to be useful it would have to affect all subscriptions under the old address (with the corresponding "address change" entry in the Activity Log of each group).

And what happens if the old address has an established password? This one I think is a bit easier. The old and new addresses should become aliases to the same profile. That way if the address change operation was mistaken or fraudulent the member wouldn't be denied access to their profile, and could sign in to correct the address change. And perhaps operate a preference to prevent future changes by moderators.

A more subtle problem is that the ability to change a member's email address may provide an circumvention to restrictions on Direct Add. Subscribe an address you control, then change it to your target address. Spammers would be likely to automate any such opportunity. I'm not sure there is a good solution to this. Even if Groups.io restricted a moderator to only one address change per day, automated spammers could employ thousands of moderators, in thousands of groups, each adding one more victim address per day. So perhaps the moderator privilege to change a member's email address would have to be guarded as closely as Direct Add. As Dano said, part of an upgraded (paid) group.

Those are some thoughts, but I'm sorry they haven't yet coalesced in my mind into a set of concrete recommendations.

-- Shal

Hey Mark,

Speaking of Delete Group,

I'm still hoping you'll separate this command in the Moderator list soon:

Modify Group Settings Or Delete Group

I need to have moderators capable of dealing with settings, but I don't want to give anyone else the right to delete the group.

Thanks,

Brenda